Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 33 papers

Filter3

Attack type

Prompt injection16 Poisoning and backdoors23 Detection evasion5

Attack technique

Gradient and representation optimization33 Automated search20 Encoding and obfuscation10 Role-play and persuasion11 Conversation structure manipulation4 Cross-modal payloads17 Defense-targeted14 Dormant triggers24 Selection manipulation5

Impact

Harmful content43 Unauthorized actions20 Data and privacy leaks14 Output manipulation33 Oversight failure3

System type

Models and APIs12 LLM applications8 AI Agent13 Multi-agent systems3

Attack surface / entry point

User input12 Web pages and interfaces3 Documents and messages8 Tool responses3 Retrieval corpus5 Memory writes4 Images, audio and video5 Training data9 Weights and gradients5 Distribution channels4

Layer

Prompt layer4 Application layer18 Training and data layer8

System component

Memory9 RAG5 Guardrails and judges5 Fine-tuning and open weights7 Vision3 Multimodal6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

Attack technique：Encoding and obfuscation Attack technique：Dormant triggers Impact：Output manipulation Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
AttacksarXiv 2610.06049Oct 5
研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
arXiv
2610.06049
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 3 4B Instruct, Qwen3 1.7B, Llama 3.1 8B Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
Abstract只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。
只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
Paper analysisRead analysis
AttacksarXiv 2610.05793Oct 5
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
arXiv
2610.05793
Published
Oct 5
Layer
Training and data layer
Setting
coding agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
AttacksarXiv 2609.33569Sep 27
信息黑洞：3D 点云重建中的后门机制研究
提出 Information Blackhole 与 AGM，控制点云自编码器后门重建到指定形状
arXiv
2609.33569
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
FoldingNet, PointDiffusion
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
AbstractAGM 用自适应高斯匹配压制 PCAE 投毒潜码中的源几何，九组设置的 CD-ASD 均下降。
这篇工作研究点云自编码器的训练时后门：干净输入仍自重建，带触发的输入应重建成攻击者指定形状。分类后门只需把预测推向离散标签。PCAE 把源几何与目标信息编进同一个连续潜空间，残留源几何会把重建拉回源形状。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.27422Sep 23
RAMP：逆转对抗扰动以增强针对恶意软件检测器的干净标签后门攻击
提出 RAMP，逆转对抗扰动加强恶意软件检测器的干净标签后门
arXiv
2609.27422
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
MalConv, MalConvGCG
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentFine-tuning and open weights
AbstractRAMP 用反转扰动做 clean-label 投毒。
RAMP 是 score-based black-box 下的 clean-label 后门增强，对象是会微调的 Windows PE 原始字节恶意软件检测器。
Paper analysisRead analysis
AttacksarXiv 2609.07147Sep 7
FDBA：联邦学习中的细粒度分布式后门攻击
提出联邦学习细粒度分布式后门框架 FDBA，用动态触发与对比嵌入降低投毒比例
arXiv
2609.07147
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2608.03844Aug 4
MAFIA：针对带审计 LLM Agent 的查询式记忆投毒攻击
提出 MAFIA，以探测放置与事实伪装对带审计 Agent 做查询式记忆投毒
arXiv
2608.03844
Published
Aug 4
Layer
Application layer
Setting
AI Agent
Evaluated models
gpt-5.4-mini, Gemini, ProtectAI and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2607.14493Jul 16
LogInject 框架披露 LLM 日志分析中的被动提示注入
提出 LogInject 框架，评测日志分析中的被动提示注入及缓解
arXiv
2607.14493
Published
Jul 16
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。
Paper analysisRead analysis
AttacksarXiv 2607.06595Jul 7
当 Agent 记得太多：针对大语言模型 Agent 的记忆投毒攻击
提出 GhostWriter 记忆投毒，经邮件与日程写入 Agent 长期记忆并跨会话激活
arXiv
2607.06595
Published
Jul 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2607.05189Jul 6
研究者提出 MemGhost，对持久化个人 Agent 实现隐蔽记忆注入
提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
arXiv
2607.05189
Published
Jul 6
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Claude Sonnet 4.5 and others6
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMemory
Abstract总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。
本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
Paper analysisRead analysis
AttacksarXiv 2606.09700Jun 9
研究者提出 HPAA 攻击：用排版视觉线索绕过 13 个内容审核系统
提出 HPAA 攻击，用排版视觉线索绕过内容审核系统
arXiv
2606.09700
Published
Jun 9
Layer
Prompt layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。
这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop